I am attempting to configure a VPS running Alpine Linux 3.18.4 to do a few things:
Accept incoming traffic on WireGuard interface wg0
, from there:
- Allow peer-to-peer communication in the
10.7.2.0/24
subnet - Provide a default route (Internet) through the WireGuard client on
wg1
(NOTeth0
)
So far WireGuard works on both interfaces. If I ip route add 1.1.1.1 dev wg0
I can ping -I wg1 1.1.1.1
. For wg0
I can ping the server from the client.
The problem is setting up SNAT/NAT/routing. I've been banging my head against a wall trying to figure this stuff out, and everything I read online seems tailored to the "I just want WireGuard clients to use the VPS' internet connection on eth0
directly" mentality. I've even been chatting in circles with ChatGPT and getting nowhere.
Below are my configuration files, but I'll leave out routing tables, rules, etc. because at this point I'll probably blow away the entire VPS and restore just the files I have here:
/etc/network/interfaces
(just wg0
, wg1
):
auto wg0
iface wg0 inet static
address 10.2.7.1/24
pre-up ip link add dev wg0 type wireguard
pre-up wg setconf wg0 /etc/wireguard/wg0.conf
post-up ip route add 10.2.7.0/24 dev wg0
post-up iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o wg1 -j MASQUERADE
post-down ip link delete wg0
post-down iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o wg1 -j MASQUERADE
auto wg1
iface wg1 inet static
address 172.30.66.233/32
pre-up ip link add dev wg1 type wireguard
pre-up wg setconf wg1 /etc/wireguard/wg1.conf
post-down ip link delete wg1
iface wg1 inet6 static
address fd00:4956:504e:ffff::ac1e:42e9/128
pre-up ip -6 addr add fd00:4956:504e:ffff::ac1e:42e9/128 dev wg1
post-down ip -6 addr del fd00:4956:504e:ffff::ac1e:42e9/128 dev wg1
I have Address
commented out in the files below because Alpine Linux doesn't like them.
/etc/wireguard/wg0.conf
:
[Interface]
# Address = 10.2.7.1/24
ListenPort = 51820
PrivateKey = [REDACTED]
[Peer]
PublicKey = [REDACTED]
AllowedIPs = 10.2.7.0/24,0.0.0.0/0,::0/0
/etc/wireguard/wg1.conf
:
[Interface]
# Address = 172.30.X.X/32
PrivateKey = [REDACTED]
[Peer]
PublicKey = [REDACTED]
AllowedIPs = 10.2.7.0/24,0.0.0.0/0
Endpoint = [REDACTED]:[REDACTED]